story-short-scan

该技能的核心用途与市场分析目标基本一致，但其实际能力包含登录态采集与从Cookie提取Bearer token调用后台API，这比普通“榜单分析”更敏感。未见明显恶意外传或第三方中转，但凭证读取、后台接口访问和未审查脚本引用使其应判为可疑而非纯良性。

No explicit signs of stealth malware, credential theft, network exfiltration, or obfuscated payloads are present in this module. However, it is a high-privilege orchestration wrapper: it spawns a local helper process via execFileSync and provides an “eval” capability by passing caller-controlled base64-encoded JavaScript to that helper. On Windows, it also determines what to execute by searching PATH for agent-browser.cmd and parsing its contents, increasing risk if the environment or cmd script can be tampered with. Treat caller inputs (especially js/args/port) and the resolved agent-browser.cmd/executable as trusted/verified to mitigate misuse.